Hybrid Comply Cookie and Mobile Tracking Notice

Effective date: 16th August 2026 · Last updated: 16th August 2026 · Version: 1.0

1. About this Notice

This Cookie and Mobile Tracking Notice explains how Hybrid HQ Ltd trading as Hybrid Comply (“Hybrid Comply”, “we”, “us” or “our”), uses cookies and similar technologies through:

• the Hybrid Comply mobile application;
• the Hybrid Comply website;
• the Hybrid Comply web portal and administrative dashboard;
• emails and electronic communications sent by Hybrid Comply; and
• other digital services that link to this Notice.

Hybrid Comply is a property health and safety inspection and compliance-reporting platform intended for use in the United Kingdom.

This Notice explains:

• what cookies and mobile tracking technologies are;
• which technologies Hybrid Comply uses;
• why we use them;
• whether they are essential;
• when we ask for consent;
• how long information is retained;
• which third parties may receive information; and
• how users can manage their choices.

This Notice should be read alongside our:

• Privacy and Data Protection Policy;
• Terms of Service;
• Data Processing Agreement, where applicable; and
• any in-app privacy information displayed when a particular permission or feature is activated.

2. Who We Are

The organisation responsible for Hybrid Comply’s use of cookies and similar technologies is:

• Legal name: Hybrid HQ Ltd
• Trading name: Hybrid Comply
• Company number: 17344036
• Registered office: 142-143 Parrock Street, Gravesend, Kent, United Kingdom, DA12 1EY
• Privacy email: hello@hybrid-hq.co.uk
• Support email: hello@hybrid-hq.co.uk

3. What Are Cookies and Similar Technologies?

A cookie is a small file placed on a computer, smartphone, tablet or other connected device when a user visits a website or uses an online service.

Cookies and similar technologies may allow a service to:

• recognise a device;
• remember a user’s preferences;
• keep a user signed in;
• maintain security;
• understand how features are used;
• diagnose technical problems;
• measure service performance;
• personalise content; or
• support advertising.

The rules concerning cookies may also apply to technologies that store information on, or access information from, a user’s device even when the technology is not normally called a cookie.

These technologies may include:

• mobile software development kits;
• local storage;
• session storage;
• web beacons and tracking pixels;
• application identifiers;
• device identifiers;
• advertising identifiers;
• scripts and tags;
• cached files;
• APIs that access device information;
• link-decoration technologies;
• push-notification tokens;
• embedded content;
• device fingerprinting; and
• similar storage or access technologies.

In this Notice, we refer to these collectively as “Tracking Technologies”.

4. Website Cookies and Mobile Tracking Technologies

Hybrid Comply may use different Tracking Technologies depending on whether a person uses:

• our public website;
• the Hybrid Comply mobile application;
• the Hybrid Comply web portal;
• an administrator dashboard;
• a customer-support function; or
• an email sent by Hybrid Comply.

4.1 Website use

On our website or web portal, Tracking Technologies may include:

• browser cookies;
• session storage;
• local storage;
• analytics tags;
• embedded support tools;
• security scripts;
• payment-provider technologies; and
• consent-management technologies.

4.2 Mobile application use

The Hybrid Comply mobile application does not necessarily use browser cookies in the conventional sense.

However, it may use mobile technologies that perform similar functions, including:

• software development kits;
• application-instance identifiers;
• secure authentication tokens;
• locally stored preferences;
• database records stored on the device;
• crash-reporting tools;
• analytics events;
• push-notification tokens;
• device and operating-system information;
• location services;
• camera and file-access permissions; and
• app-store subscription technologies.

4.3 Emails

Where legally permitted, emails sent by Hybrid Comply may contain limited tracking technologies that help us determine:

• whether an email was delivered;
• whether it was opened;
• whether a link was selected;
• whether an operational notification failed; and
• whether communications are effective.

Marketing-email tracking will be treated separately from technologies necessary to deliver security, account or inspection notifications.

Users may be able to limit some email tracking by disabling automatic image loading in their email application.

5. Categories of Tracking Technologies

We classify our Tracking Technologies according to their purpose.

5.1 Strictly Necessary Technologies

These technologies are essential to provide a service requested by the user or to operate Hybrid Comply securely.

They may be used to:

• create and maintain a login session;
• authenticate a user;
• remember security settings;
• prevent fraud and unauthorised access;
• route network traffic;
• balance system load;
• save a user’s cookie or tracking preferences;
• process a payment;
• maintain a subscription;
• store inspection information awaiting synchronisation;
• preserve an unfinished form during a session;
• provide a feature specifically requested by the user; or
• protect the Service against malicious activity.

Where a technology is genuinely necessary for these purposes, we may use it without obtaining optional tracking consent.

Users cannot normally disable strictly necessary technologies through our consent controls because Hybrid Comply may not function securely or correctly without them.

Users may still be able to block them through browser or device settings, but doing so may prevent access to some or all of the Service.

5.2 Functional Technologies

Functional technologies provide optional features or remember choices that are not essential to the core Service.

They may be used to:

• remember a preferred language;
• retain display preferences;
• remember a recently selected property;
• enable optional embedded maps;
• remember optional accessibility settings;
• support live chat;
• retain optional interface customisation; or
• connect Hybrid Comply with a user-selected third-party service.

Where required, functional technologies will not be activated until the user has consented.

Disabling these technologies may reduce convenience or prevent the relevant optional feature from working.

5.3 Analytics and Performance Technologies

Analytics and performance technologies help us understand and improve Hybrid Comply.

They may be used to measure:

• the number of website visitors or app users;
• which screens and features are used;
• session duration;
• navigation paths;
• app version and operating-system distribution;
• feature adoption;
• synchronisation performance;
• error rates;
• crash information;
• page or screen loading times;
• general geographic region derived from an internet protocol address;
• referral source; and
• whether product changes improve reliability.

Where consent is legally required, these technologies will remain disabled until the user gives consent.

Where a specific legal exception permits limited statistical use without consent, we will use it only after confirming that all relevant conditions are satisfied. This may include providing clear information, offering a simple way to object and ensuring the information is not used to identify, profile or target individuals.

As a default product-design position, Hybrid Comply should use consent for optional third-party analytics unless a documented assessment confirms that another approach is lawful.

5.4 Security and Fraud-Prevention Technologies

Security technologies may be used to:

• detect suspicious login activity;
• identify automated attacks;
• prevent account takeover;
• enforce rate limits;
• detect malware;
• investigate security incidents;
• validate application integrity;
• identify unsupported or compromised app versions; and
• protect users, properties and inspection information.

These technologies may collect:

• internet protocol addresses;
• device type;
• operating system;
• application version;
• authentication events;
• network information;
• approximate location;
• failed-login information; and
• unusual activity indicators.

We use only the information reasonably necessary for security purposes and do not use security technologies as a disguised form of behavioural advertising.

5.5 Advertising and Marketing Technologies

Hybrid Comply does not currently use third-party behavioural advertising technologies unless expressly identified in the technology register below.

We will not activate advertising technologies in the mobile app or website without:

• assessing their privacy impact;
• providing clear information;
• obtaining consent where required;
• offering granular choices;
• providing an easy withdrawal method; and
• updating this Notice.

Advertising or marketing technologies may otherwise be used to:

• measure a marketing campaign;
• attribute a registration to a campaign;
• limit repeated advertisements;
• create marketing audiences;
• personalise advertising; or
• track activity across services.

Hybrid Comply will not use property inspection records, inspection photographs, tenant information, school information or safety findings for targeted advertising.

5.6 Customer-Support Technologies

Where a user opens a support tool, Hybrid Comply may use technologies supplied by a support provider to:

• maintain a support session;
• associate a request with an account;
• route an enquiry;
• diagnose an error;
• record support history; or
• enable an optional live-chat feature.

Optional support widgets will not load before consent where consent is required.

Users may contact us by email instead where they do not wish to activate an optional support technology.

6. Mobile Device Permissions

Mobile permissions are different from, but may operate alongside, Tracking Technologies.

Hybrid Comply may request access to the following device features.

6.1 Camera

Camera access allows users to:

• photograph hazards or defects;
• capture inspection evidence;
• scan documents or codes; and
• add images to compliance reports.

The camera is activated only when the user selects a camera-related feature.

Hybrid Comply does not continuously access the camera.

6.2 Photos, Media and Files

Photo-library or file access may allow users to:

• upload existing inspection evidence;
• attach certificates or documents;
• save or export reports; and
• select files required for an inspection.

Where supported by the operating system, Hybrid Comply should request access only to selected files or photographs rather than an entire media library.

6.3 Location

Location access may be used to:

• verify where an inspection occurred;
• associate an inspection with a property;
• record evidence metadata;
• display a property on a map;
• identify an appropriate site; or
• help prevent fraudulent or inaccurate inspection records.

Depending on the feature and the permission selected, Hybrid Comply may receive precise or approximate location information.

Unless separately and prominently disclosed, Hybrid Comply will not continuously track a user’s location when the app is not in active use.

Background location access will not be requested unless:

• it is necessary for a clearly identified feature;
• the feature cannot reasonably work using foreground access;
• the user receives a prominent explanation before the system permission request;
• an appropriate legal basis has been documented; and
• the user can later disable the permission.

Location permission may be changed through device settings.

Disabling it may prevent location-verification or mapping features from working.

6.4 Notifications

Notification permission allows Hybrid Comply to send:

• inspection assignments;
• due-date reminders;
• remedial-action updates;
• security alerts;
• service announcements;
• report notifications; and
• optional marketing messages where separately permitted.

Operational notifications and optional marketing notifications should be separately configurable where technically possible.

Users can manage notifications through Hybrid Comply’s settings and their device settings.

6.5 Microphone

Where Hybrid Comply offers voice-note or video features, microphone access may allow a user to record audio as part of an inspection.

The microphone will be accessed only when the user activates a recording feature.

Hybrid Comply does not continuously listen through the microphone.

6.6 Biometric Authentication

Hybrid Comply may allow users to unlock the app using device-based facial recognition, fingerprint recognition or another biometric method.

The biometric template is normally managed by the device operating system.

Hybrid Comply should receive only confirmation that authentication succeeded or failed and should not receive or store the underlying fingerprint or facial template.

6.7 Device Storage and Offline Functionality

Hybrid Comply may store limited information locally to:

• maintain a secure session;
• support offline inspections;
• save an unfinished inspection;
• queue photographs or reports for upload;
• remember settings; and
• improve app performance.

Locally stored inspection information should be protected using device security and application-level safeguards where appropriate.

Users should upload or synchronise inspection records before uninstalling the application or replacing a device.

7. Consent

Where consent is required, Hybrid Comply will request it before activating the relevant non-essential Tracking Technology.

Consent requests will:

• use clear and understandable language;
• identify the relevant purposes;
• provide a genuine choice;
• avoid pre-selected optional choices;
• avoid treating inactivity as consent;
• provide separate choices for materially different purposes;
• make rejection as accessible as acceptance;
• avoid bundling consent into general Terms of Service; and
• explain how consent can be withdrawn.

A user’s access to core Hybrid Comply functions will not be made conditional on consenting to unnecessary analytics, advertising or personalisation technologies.

Consent to Tracking Technologies is separate from:

• accepting the Terms of Service;
• the lawful basis for processing account information;
• consent to receive marketing communications;
• permission to access the camera, location or files; and
• a customer’s authority to collect inspection information.

8. Consent Controls

Where applicable, users can manage choices through:

• the “Cookie Settings” link on our website;
• the consent banner;
• the “Privacy”, “Tracking” or “Analytics” section in the Hybrid Comply app;
• device privacy settings;
• browser settings;
• operating-system permission controls;
• app-store privacy settings; or
• a request to hello@hybrid-hq.co.uk.

Our consent controls should provide separate choices for:

• functional technologies;
• analytics and performance;
• advertising or marketing;
• optional support tools; and
• any other distinct non-essential purpose.

Withdrawing consent will not affect the lawfulness of activity that occurred before withdrawal.

When consent is withdrawn:

• future optional collection should stop;
• the relevant optional technology should be disabled where technically possible;
• any retained personal data will be deleted or anonymised unless another lawful basis or retention requirement applies; and
• the preference may be stored so we can respect the user’s decision.

9. Changing Browser and Device Settings

9.1 Browser controls

Most browsers allow users to:

• view stored cookies;
• delete cookies;
• block all cookies;
• block third-party cookies;
• receive a warning before a cookie is placed;
• clear local storage; and
• use private-browsing modes.

Blocking all cookies may prevent the web portal from:

• keeping a user signed in;
• maintaining secure sessions;
• remembering privacy choices;
• saving an unfinished form; or
• completing a payment.

9.2 Mobile controls

Mobile operating systems may allow users to:

• disable or reset an advertising identifier;
• limit tracking requests;
• disable location access;
• select precise or approximate location;
• restrict camera, microphone, photo or file access;
• disable notifications;
• remove locally stored app information; and
• uninstall the application.

The exact controls depend on the device, operating system and application version.

9.3 Global privacy signals

Where technically and legally appropriate, Hybrid Comply may recognise browser-based privacy preference signals.

Because these signals do not always correspond to every category of Tracking Technology, users should also review Hybrid Comply’s consent settings.

10. Consent Duration and Renewal

There is no single consent duration suitable for every technology.

We determine how long to rely on a consent choice by considering:

• the nature of the technology;
• the purpose;
• user expectations;
• the sensitivity of the information;
• whether our practices have changed;
• changes to providers;
• the frequency of use; and
• applicable regulatory guidance.

We may ask users to review their choices periodically.

We will request fresh consent where:

• we introduce a materially new purpose;
• we add a technology that is not reasonably covered by the original choice;
• we change from first-party to materially different third-party tracking;
• the original consent is no longer sufficiently specific or informed; or
• consent has been withdrawn or has otherwise become invalid.

We should not repeatedly ask a user who has rejected optional technologies unless:

• a reasonable period has passed;
• the relevant service has materially changed;
• the user opens the settings voluntarily; or
• another valid reason applies.

11. Information Collected Through Tracking Technologies

Depending on the technology and the user’s choices, we may collect:

• cookie or technology identifier;
• application-instance identifier;
• session identifier;
• internet protocol address;
• approximate geographic region;
• device manufacturer and model;
• operating system;
• browser type;
• application version;
• screen size;
• language;
• time zone;
• network type;
• pages or app screens viewed;
• buttons or features selected;
• referring webpage;
• campaign source;
• session length;
• login and authentication events;
• crash logs;
• error messages;
• performance information;
• synchronisation events;
• consent choices;
• notification token;
• payment-session identifier; and
• security indicators.

Optional analytics should not intentionally receive:

• inspection photographs;
• inspection videos;
• property-access codes;
• free-text inspection notes;
• signatures;
• tenant names;
• pupil names;
• sensitive compliance findings;
• payment-card information; or
• special-category information,

unless the disclosure is strictly necessary, specifically assessed and clearly explained.

Hybrid Comply should configure analytics tools to exclude free-text fields, image contents and sensitive inspection payloads.

12. Legal Bases

The placement of or access to information on a device is governed separately from the subsequent processing of any personal data obtained through that technology.

Depending on the circumstances, we may rely on:

12.1 Consent

Consent will generally be used for:

• optional analytics;
• marketing measurement;
• behavioural advertising;
• non-essential personalisation;
• optional third-party support widgets;
• optional embedded media; and
• any other non-essential storage or access activity where consent is required.

12.2 Performance of a Contract

We may process personal data where necessary to:

• authenticate a user;
• maintain an account session;
• provide requested app functionality;
• synchronise an inspection;
• provide a purchased subscription; or
• process a payment.

This does not remove any separate requirement to obtain consent before storing information on or accessing information from a device.

12.3 Legitimate Interests

We may rely on legitimate interests for subsequent personal-data processing connected with:

• service security;
• fraud prevention;
• limited operational diagnostics;
• service reliability;
• establishing or defending legal claims; and
• understanding aggregated service performance where appropriate.

We will assess whether our interests are necessary and balanced against users’ rights and expectations.

Legitimate interests will not be used as a substitute for Tracking Technology consent where consent is legally required.

12.4 Legal Obligations

We may process information where necessary to comply with:

• tax and accounting duties;
• lawful regulatory requests;
• security or breach obligations;
• court orders; or
• another applicable legal requirement.

13. Third-Party Providers

Some Tracking Technologies may be supplied or operated by third-party providers.

Depending on the provider and purpose, that provider may act as:

• our processor;
• our subprocessor;
• a joint controller;
• an independent controller; or
• a provider that processes different categories of information in different roles.

We assess relevant providers before implementation and seek to ensure appropriate contractual, security and data-protection safeguards are in place.

Third parties may receive information directly from a user’s browser or device when their technology is activated.

Their use of information may also be governed by their own privacy notices.

14. International Transfers

Some providers may process information outside the United Kingdom.

Where personal data is transferred internationally, we will use an appropriate safeguard where required, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another legally recognised transfer mechanism.

We will assess relevant transfer risks and implement supplementary safeguards where appropriate.

Information about particular providers and processing locations should be included in the technology register below.

15. Retention

Tracking information is retained only for as long as reasonably necessary for its purpose.

Retention may differ according to the technology.

Our intended baseline periods are:

The final technology register must state the actual duration of each cookie, SDK identifier or similar technology.

16. Data Security

We use reasonable technical and organisational safeguards for information collected through Tracking Technologies.

These may include:

• encryption in transit;
• secure storage;
• access restrictions;
• token expiry;
• secure authentication;
• separation of production and test environments;
• supplier security assessments;
• monitoring;
• data minimisation;
• pseudonymisation;
• retention controls; and
• restrictions on information sent to analytics providers.

No internet or mobile service is completely secure.

Users should:

• keep their devices and operating systems updated;
• use device-locking features;
• protect account credentials;
• avoid using unsecured shared devices; and
• report suspected unauthorised access.

17. Children

Hybrid Comply accounts are intended for authorised adults and are not directed at children.

Hybrid Comply may be used by adult inspectors in schools, leisure facilities, hotels, homes and other properties where children may be present.

Tracking Technologies must not be used to create advertising profiles of children through Hybrid Comply.

Hybrid Comply does not knowingly use inspection records involving children for advertising or cross-service tracking.

If we discover that optional tracking has been applied directly to a child without an appropriate legal basis or safeguard, we will take reasonable steps to stop the activity and delete or restrict the information.

18. Do Not Track and Advertising Choices

Some browsers offer a “Do Not Track” setting. There is no universally implemented interpretation of every such signal.

Hybrid Comply will use its own consent controls as the primary method for recording Tracking Technology choices, while supporting recognised privacy signals where appropriate.

Where Hybrid Comply uses advertising providers, users may also be able to manage advertising preferences through:

• their device’s advertising settings;
• the relevant app store;
• the advertising provider’s controls; and
• Hybrid Comply’s consent settings.

Resetting an advertising identifier does not necessarily withdraw consent within Hybrid Comply. Users should use Hybrid Comply’s settings to record withdrawal.

19. Current Technology Register

The following register must be completed after conducting a technical audit of the production website, mobile apps, web portal, payment flow, email service and all embedded third-party code.

Technologies must not be described as “strictly necessary” merely because they are useful to Hybrid Comply. The classification must be based on whether the technology is essential to provide a service requested by the user or falls within another applicable legal exception.

Register status: the Hybrid Comply website and dashboard currently use only strictly necessary technologies (authentication, session and security storage via Firebase). No analytics, advertising or third-party tracking technologies are deployed. This register will be updated before any such technology is introduced.

20. Our Commitment on Inspection Information

Hybrid Comply will not intentionally configure general website or product-analytics technologies to collect the contents of:

• inspection photographs;
• inspection videos;
• inspection notes;
• tenant or occupant details;
• school or pupil information;
• signatures;
• property-access instructions;
• uploaded certificates;
• compliance reports; or
• remedial-action descriptions.

Where error monitoring could inadvertently capture such content, Hybrid Comply will use reasonable controls such as:

• field masking;
• input suppression;
• payload filtering;
• screen-recording restrictions;
• sampling restrictions;
• access controls; and
• short retention periods.

Hybrid Comply will not use inspection content for behavioural advertising.

21. Changes to this Notice

We may update this Notice when:

• Tracking Technologies change;
• we add or remove a provider;
• a purpose changes;
• retention periods change;
• the law or regulatory guidance changes;
• app permissions change; or
• we introduce a new digital feature.

The “Last updated” date identifies the latest version.

Where a change affects an existing consent, we will request fresh consent when required.

Material changes may also be communicated through:

• an in-app message;
• a renewed consent request;
• an email;
• the website; or
• account notifications.

22. Contact Us

Questions or complaints concerning Tracking Technologies should be directed to:

• Legal name: Hybrid HQ Ltd
• Trading name: Hybrid Comply
• Company number: 17344036
• Registered office: 142-143 Parrock Street, Gravesend, Kent, United Kingdom, DA12 1EY
• Privacy email: hello@hybrid-hq.co.uk
• Support email: hello@hybrid-hq.co.uk

Users also have the right to raise data-protection concerns with the UK Information Commissioner’s Office.